[coverage] Conformance findings: AUTH-019

Aperta
  • Qualcosa non va?
#546 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
66/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
go
Ambito
databases

Direzione di ricerca

Start by reading the Go driver’s OAuth M2M scope handling and locate the tests for TestOAuthM2MTokenRequestUsesConfiguredScopes; the issue does not name their paths. Compare configured, whitespace-padded, blank, and unset scopes against the expected token request in the issue. Done when both Thrift and SEA send one sql token for sloppy scopes, and blank or unset scopes request all-apis and complete successfully.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

Surfaced by the multi-language coverage fan-out while conformance-testing these SPEC-IDs against databricks/databricks-sql-go. Each finding is committed as an expected-failure (xfail) test in the coverage PR — the test asserts the CORRECT (post-fix) behavior and stays red until THIS driver (databricks/databricks-sql-go) is fixed, then flips green as a tripwire.

Findings

  • AUTH-019 [thrift]: Thrift OAuth M2M forwards configured scopes verbatim: inner whitespace is not split and duplicates are not dropped (" sql sql " -> two sql tokens), and a whitespace-only entry is sent as-is so the token endpoint rejects the client_credentials grant with invalid_scope instead of falling back to all-apis
    • failing test: TestOAuthM2MTokenRequestUsesConfiguredScopes (see the coverage PR diff under tests/)
  • AUTH-019 [sea]: SEA/kernel OAuth M2M forwards configured scopes verbatim: a scope entry's inner whitespace is not split and duplicates are not dropped, so " sql sql " is sent as two sql tokens instead of one
    • failing test: TestOAuthM2MTokenRequestUsesConfiguredScopes (see the coverage PR diff under tests/)
  • AUTH-019: OAuth M2M forwards configured scopes verbatim: a scope entry's inner whitespace is not split and duplicates are not dropped (" sql sql " is sent as two sql tokens on both thrift and sea), and on the Thrift path a whitespace-only entry is sent as-is so the workspace token endpoint rejects the client_credentials grant with invalid_scope instead of falling back to all-apis (the kernel/SEA path handles the blank entry correctly)

Reproduce & Expected

AUTH-019 — Verifies that the driver's OAuth scopes option decides what the client-credentials (M2M) token request asks for, instead of always requesting all-apis, so a service principal whose secret is scoped…

Reproduce:

SELECT CURRENT_USER() AS user
SELECT CURRENT_USER() AS user
SELECT CURRENT_USER() AS user
SELECT CURRENT_USER() AS user

Expected (per the shared spec):

  • result has exactly 1 row(s)
  • result has exactly 1 row(s)
  • result has exactly 1 row(s)
  • result has exactly 1 row(s)
  • full assertion contract:
result:
- label: configured_scopes
  oauth_token_request_scope_tokens:
    grant_type: client_credentials
    equals:
    - sql
- label: configured_scopes
  row_count: 1
- label: sloppy_scopes
  oauth_token_request_scope_tokens:
    grant_type: client_credentials
    equals:
    - sql
- label: sloppy_scopes
  row_count: 1
- label: blank_scopes
  oauth_token_request_scope_tokens:
    grant_type: client_credentials
    equals:
    - all-apis
- label: blank_scopes
  row_count: 1
- label: unset_scopes
  oauth_token_request_scope_tokens:
    grant_type: client_credentials
    equals:
    - all-apis
- label: unset_scopes
  row_count: 1
protocol:
  thrift:
  - call_min:
      method: OpenSession
      min: 1
  sea:
  - call_min:
      operation: CreateSession
      min: 1

Context

Lingua principale
Go
Stelle
54
Fork
71
Merge medio
16h 3m
PR unite (30g)
21

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di databricks/databricks-sql-go

Tutte le issue di databricks/databricks-sql-go

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.